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MEMORANDUM FOR: 


VIA: 


FROM: 


SUBJECT: 


REFERENCE: 


SECRET 


20 NOV 1964 
ODP-84-1727 


Chief, Audit Staff 


Deputy Director of Administration 


Director of Data Processing 


Report of Audit of Office of Data Processing 
For the Period 1 May 1982 - 31 May 1984 (S) 


Memo for D/ODP fm C/AS, dtd 25 Oct 84, 
Same Subject (ODP-84-1607) 


1. The following are ODP's actions on the recommendations 
contained in the referenced report: 


Recommendation No. l: Develop and maintain a comprehensive 


disaster recovery plan. 


ODP Action: 


We recognize the lack of a disaster recovery 


plan aS a serious shortfall. Consequently, in previous 
years we submitted budget initiatives for a backup computer 
center, but were unsuccessful in defending them through the 
budget process. In FY 1986, this requirement is being 
addressed in the Office of Communications’ Systems 
Survivability Initiative. 


Without a backup computer facility, developing a 
comprehensive disaster recovery plan would prove to be a 
fruitless exercise--the plan would simply be overtaken by the 
specifics of the disaster. However, we are doing some things 
in our normal course of business which will help make future 
planning easier--purchasing hardware which will be compatible 
across our centers; minimizing operating system differences; 
providing the facility to place critical applications under 
production control; and, backing up our systems routinely 
including off-site storage. 
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For Period 1 May 1982 - 31 May 1984 


While even these simple activities can be construed to 
provide us with some recovery capability, it would be naive 
to assume any capability would survive a true disaster. The 
cornerstone of a comprehensive plan is off-site control of 
both the hardware and software resources. 


Recommendation No. 2: Use ACF2 to verify authorization to 
check out ODP tapes. 


ODP Action: We are investigating the use of ACF2, as well as 
other facilities, to verify authorization to check out our 
tapes. 


Recommendation No. 3: Conduct annual tape inventories and 
retain applicable documentation for audit. 


ODP Action: Processing Systems Group will conduct an annual 
Tape Library inventory during the first quarter of each 
calendar year. 


Recommendation No. 4: Update and maintain the Tape 
Management Catalog. 


ODP Action: The Tape Management Catalog is being updated. 
The maintenance procedures for the catalog are also being 
updated. 


Recommendation No. 5: Improve minidisk access controls. 


ODP Action: We have begun the time and resource intensive 
process of defining user-written disk access authorizations. 
Because the effort is costly, we are also investigating 
alternative methods. 


Recommendation No. 6: Conduct an inventory of WANG equipment 
and update the accountable property records accordingly. 


ODP Action: Our Logistics Staff is conducting an inventory 
of WANG equipment. Upon its completion, property records 
will be updated and maintained by this staff. 


Recommendation No. 7: Update and maintain the formal and 
informal records of lease/purchase equipment. 


ODP Action: Lease/purchase equipment records have been 
updated and will be kept current. 
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Recommendation No. 8: Establish consolidated memorandum 
receipt accounts for in-use property. 


ODP Action: Consolidated memorandum receipt accounts for in- 
use property have been established. 


Recommendation No. 9: Reconcile lease/purchase information 
in the Logistics Branch to data in the Resource Acquisition 
Management Staff. 


ODP Action: Lease/purchase information in the Logistics 
Branch has been reconciled with that in the Resource 
Acquisition Management Staff. 


Recommendation No. 10: Appoint a WANG systems manager. 


ODP Action: The Chief, Logistics Staff is the WANG systems 
manager and will institute appropriate procedures for 
maintaining property records of WANG equipment. (See 
Recommendation No. 6 Above) (S) 


2. If you or your staff have an uestions on this matter, 
please call 


25X1 


cc: IG 
O/Compt /BMG 
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SECRET 


SUBJECT: Report of Audit of Office of Data Processing 
For the Period 1 May 1982 ~- 31 May 1984 


25X1 C/P& po/us/ood | 16 Nov 84) 


Distribution: 


Original - Addressees 

- Inspector General 

- O/Compt/BMG 

- O/D/ODP 

ODP Registry 

- MS File ¢ Audit of ODP) 
- MS Chrono 


PRON HE 
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ODP STAFF SUMMARY SHEET 


SUBJECT: 
Report of Audit of Office of Data Processing 
For the Period 1 May 1982 - 31 May 1984 


PURPOSE OF ACTION: 


D/ODP Approval/Signature 


REFERENCES: 
Memo for D/ODP fm C/AS, dtd 25 Oct 84, 
Same Subject (ODP-84-L607) 


RESOURCE PACKAGE & COSTS (If applicable): 


THIS PAPER IS FOR YOUR: 


COMPONENT/ INFORMATION/ APPROVAL/ 
OFFICER COMMENT CONCURRENCE SIGNATURE INITIALS 


C/MS x 


go Nes 
EXO/ODP x 


DD/ODP x 


D/ODP Xx 


DISCUSS SION: 


i 4! ‘ er! - 
Con Dutroh } mt Comtgariono | ron 
fhe vee fac abe T tutdy come fe ure 


to soe! STAT 


ADD TO OFFICIAL FILE YES NO 


4026 «a-79) gortions oN (36) 
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Explanatory Notes 


Subject: Self-explanatory - include ODP number if applicable. 


Purpose: What will action accomplish, e.g., "Reply to letter 
from OMB," "Obtain DDA approval to spend $100M," 
"Comply with periodic reporting requirements," etc. 


Action Officer: Name, organization, extension. 


References: List of pertinent references. Copies should be 
attached in order listed. 


Resource Package and Costs: Identify the Resource Package and 
total costs for each fiscal year 
if the action involves funds. 


Routing: Who should see the action, whether for information, 
comment, concurrence, or signature/approval. The 
individual reviewing the action should initial and 
date where indicated. Place an "x" under the appro- 
priate column for each component. If concurrences 
are contained on record copy of action, simply refer 
to the action. 


Discussion: Narrative discussion of action - what led up to 
the action, why is it necessary, what do you want 
done. The pertinent references should be explained 
insofar as they relate to this action. If the ac- 
tion itself contains all this information, simply 
refer to the action. 


Signature of Action Officer: Sign and date form. 


Classification: Mark at the top and bottom of page, as appro- 
priate. 
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DATE: November 15, 1984 


SUBJECT: Audit Report 


Tom- 


for comments on the report, since as C/OSD she is 
d, and her comments are appended. I also talked to 
concerning compatibility of the centers, and he agreed 

a e exception of MVS/XA, which currently runs only in 
Northside, there should be no major differences. I have appended his 
comments also. We (SEG) have not really been much involved in any 
disaster planning exercises, so I'm not sure how much has been done to 
identify priority applications, etc. 


Ro 


**% APPENDED oo ne ot November 15, 1984 AT: 12:51 PM ¥### 


DATE: November 15, 1984 
SUBJECT: AUDIT Report 


I would suggest the following wording change to the ODP Action on 
Recommendation #2: 


ODP is investigating the use of ACF2 or another facility to 
verify authorization to check out ODP tapes. 


I don't know why they said ACF2 could only be used to solve part of the 
problem consequently I think the above is a better statement. 


kp 


**# APPENDED BY:[ | ON: November 15, 1984 AT: 12:51 PM ##% 
DATE: November 15, 1984 


SUBJECT: Report of Audit of ODP 


Concerning recommendation 1 (disaster recovery), I think that the 
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recommendation could be take two ways: 
a) offsite backup. 
b) running work in different centers. 


In both cases, someone needs to define just what ‘important work' 
needs to be run. This should be C&AG's responsibility. They run most 
of the critical work as well as all of the major (corporate) database 
systems. They also handle all backup copies of disks (the DBCC for GIMS 
and SAB for VM/MVS). 


Since we are now running multiple centers with both MVS and VM, I 
think that we have been forced to a great deal of compatability between 
centers just for minimizing our own work. This has had the side effect 
of having systems which will permit us to run any of our applications on 
any of the systems. 


The biggest problem I forsee is that compatable disk types may not 
be available in all centers. For example, GIMS in Ruffing Center 
currently runs on 3330's (converting very soon to 3380's). We do not 
have 3330's in Special or Northside Centers. 


As far as the offsite backup, this will depend on money as Gail has 
indicated. However, we currently support VM at W2 as well as VM and MVS 
at the DIAC. Whether the DIAC systems have sufficient compatability is 
not Known. 


Alth could theoretically restore our systems from tapes we 
have sent I have very large reservations as to how longs this 
would take and if it would really work. Although the tapes are at 


it is not clear to me that we have adaquate documentation of just what 
is on the tapes so that we could actually rebuild our systems. 


As far as the other recommendations and the responses, I have no 
additional comments. 


Gene 
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25 October 1984 


MEMORANDUM FOR: Director of Data Processing 


VIA: Inspector General 
mel, Audi taf Ff 
SUBJECT: Report of Audit of Cffice cf Lata Processing 


For the Period 1 May 1982 - 31 May 1984 


1. Subject report is attached for your review. Please 
advise nme of action taken on the recommendations contained in 
the report. 


2. We appreciate the cooperation and assistance extended 
the auditors during the audit. 


25X1 
Distribution: 
Original - D/ODP 
1 - DDA 
1 - O/Compt/ BMG 
25X1 
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REPORT OF AUDIT 
Office of Data Processing 


For the Period 
1 May 1982 to 31 May 1984 


SUMMARY 


1. Financial and logistical internal controls, procedures 
and records of the Office of Data Processing (ODP) were, except 
as noted below,, generally effective and in accordance with 
Agency regulations. Prior ‘audit recommendations were satis- 
factorily resolved, with the exception of two. that pertain to 
disaster recovery and tape check out controls. This report 
includes comments and recommendations concerning: 


: - developing a disaster recovery plan; 


- strengthening controls over the check out of 
tapes; 


- conducting annual tape inventories; 
~ maintaining the Tape Management Catalog; 
- improving mini disk access controls; and 


- strengthening control and administration of 
ODP's Wang equipment and lease/purchase equip- 
ment. 
Other administrative matters, including formalizing 
delinquent advance follow-up procedures and resolving 
audit inventory discrepancies, were discussed with 
responsible officials and Satisfactorily résolved during 
the audit. 


2. As requested by the Director of Lata Processing, 
we provided comments to him concerning the Agency's vul- 
nerability to external and internal computer penetration, 
as well as ODP's commitment to a unique VM environment and 
GIMS as the primary data base Management system. 


SCOPE AND PURPOSE 
3. The audit included a review of administrative 
functions to evaluate the effectiveness of internal 


controls and procedures and to assure compliance with 
Agency regulations. Financial and logistical transactions 
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were‘ tested to determine whether documentation, approvals 
and certifications were in accordance with applicable 
accounting and reporting requirements and to ensure that 
expenditures were within the scope of authorized activi- 
ties. 


4. The audit also included reviews and tests in the 
Ruffing, Northside, and Special Computer Centers to deter- 
mine whether established procedures and other documenta- 
tion were sufficient, adequate and followed to provide 
effective operations and to protect against potential 
security and safety risks. 


BACKGROUND 


5. ODP provides a central computer service for 
Agency components and other Intelligence Community 


esponsible for: 


es as assigned and has a personnel ceiling of 


- Teviewing and coordinating Agency proposals 
for the acquisition of computer hardware 
(including word processing equipment), soft- 
ware, and services; 


- operating five computer centers (Ruffing, 
Special, 4C, W2, and Northside) that provide 
facilities and services for batch and inter- 
active computer processing, data base manage- 
ment, and online information storage and 
retrieval; 


~- developing and implementing application 
systems; and - 


~ performing maintenance and production control 
of completed application programs. 


6. The ODP operating budget | re Fiscal 
Year 1984 is summarized in the attac ed Exhibit. 
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DETAILED COMMENTS 


Disaster Recovery Plan 


8. ODP still needs to develop a comprehensive disaster 
recovery plan as recommended in the prior three audits. A plan 
is needed to minimize the length and magnitude of service 
interruption in an emergency situation. Although ODP had 
accepted the prior recommendations and intends to eventually 
develop such a plan, it has not done it due to other priori- 
ties. Because of Agency dependence on data processing, the ILLEGIB 
plan should identify priority applications, alternative compu- 
ter centers and other matters to consider in emergency situa- 
tions. While ODP is already aware of Many of the actions to 
take in an emergency, a comprehensive contingency plan is sti 
important to ensure a practical and testable program witb 
Tesource constraints. 


Recommendation #1: Develop and maintain a 
comprehensive disaster recovery plan. 


Tape Check Out Control 


9. ODP accepted but still needs to implement a prior 
audit recommendation to use the security control software 
package, Access Control Facility 2 (ACF2), to verify individual 
authority to remove ODP tapes from the various computer cen- 
ters. At present anyone with a valid badge can check out an 
ODP tape by merely identifying the reel number and dataset 
name. ACF2 would improve security by matching a user's iden- 
tity to its information that authorizes check out privileges. 
ODP already uses ACF2 to control the removal of certain non-ODP 
tapes and will soon use it to control tape access from VM. It 
could also be used to control all tapes subject to withdrawal. 
ODP tapes have not been accorded this control because they are ILLEGIB 
not withdrawn as often as the tapes presently controlled by 
ACF2. While responsible officials had agreed with the prior 
recommendation, other priorities apparently have prevented i 
timely implementation. 


Recommendation #2: Use ACF2 to verify 
authorization to check out ODP tapes. 


Annual Tape Inventory 


10. The Ruffing Center Tape Library should retain evidence 
of its tape inventories to document compliance with ODP policy 
requiring annual inventories. According to library officials 
an inventory was taken in February 1983, although they could 
only locate documentation dated June 1981. They apparently 
misplaced the 1983 documentation and did not take an inventory 
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in 1982. Inventories consist of reconciling automated inven- 
tory listings to physical tapes and resolving discrepancies to 
ensure adequate tape controls. [An inventory was in progress 
during the audit but it had not been reconciled because of 
_unresolved rere Crpiag te agreed to 
conduct inventories in the future as required and to retain 
evidential documentation. 


Recommendation #3: Conduct annual tape 
inventories and retain applicable docu- 
mentation for audit. 


Tape Management Catalog 


11. The Tape Management Catalog (TMC) is used to track the 
current status and location of tapes in ODP libraries. We 
noted that the TMC was not accurate in depicting the quantity 
or location of tapes because certain data fields have not 
always been maintained on a current basis or updated to reflect 
inventory results. Failure to maintain and update the TMC 
diminishes its value as a control and inventory tool. 


Recommendation #4: Update and maintain 
the Tape Management Catalog. ~ 


Mini Disk Access Controls 


12. ODP could strengthen controls to detect or prevent 
unauthorized access to individual or office mini disk files. 
By using the GOTO NAMES facility, some users presently could 
access more than 250 such mini disks which could contain links 
to additional disks. While present security practices include 
monitoring failed GOTO accesses, they sometimes do not include 
monitoring successful accesses. One way to improve control 
would entail requiring disk owners or ADP Control Officers to 
review automated listings of successful accesses to detect 
penetration of their respective files. Although ODP already 
makes such listings available, only about 25 percent of the 
users request them. Increasing users' awareness in this area 
and requiring their post review of access listings would be a 
practical way to improve security within present resource con- 
straints. 


13. Another, but more resource intensive way to improve 
security, would be to use VLINK, an automated facility that 
controls disk access based on written user authorizations 
submitted to ODP. Although using VLINK would involve changing 
all disk passwords and other setup problems, these initial 
costs would provide long-term security benefits. ODP agreed to 
consider appropriate procedures to improve mini disk access 
controls. 
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Recommendation #5: Improve mini disk 
access controls as discussed above. 


Property Administration 


14. ODP needs to comply with regulations and to improve 
procedures and records in its administration of Wang equipment 
and lease/purchase equipment. 


15. ODP has omitted from its accountable property records 
Wang word processing and personal computer equipment valued at 
25xX1 Laer prods! has been acquired for its own use. ODP omitted 
Operty because it has not designated a focal point 
officer to take custodial responsibility for the equipment, to 


Sign a hand receipt, and to keep the ODP Logistics Branch in- 
formed on adjustments required in property records. The Logis- 


tics Branch needs such information since equipment transactions 
have been made directly with user offices, [| 25X1 
25X1 equires the maintenance of perpetual accountable 


cords to include prescribed documentation in support 
of acquisitions, dispositions and loans. It also requires the 
taking of annual inventories to confirm or appropriately adjust 
the records. The equipment has never been inventoried. ODP 
should strengthen procedures and internal controls to ensure 
safeguards over these assets and compliance with these regula- 
tions. To that end, ODP should consider appointing a Wang 
Systems manager to operate as the focal point in these 
matters, ODP officials have agreed that improvements in Wang 
property administration are needed. 


16. The ODP Logistics Branch has not updated, since 


October 1982 i records that are required by 
25X1 to facilitate control over in-use 
e bought under lease/purchase contr 
Consequently, these records understate by approximately 25X1 
25X1 [___|the value of equipment that is pr i Cquired 
€T Such contracts. We also noted chatfe DE 25X1 
equipment purchased under lease/purchase contracts has not been 


picked up on the formal accountable property records. This 
causes related understatements in property values that ODP 
annually reports to the Office of Finance for inclusion in the 
Agency's financial accounts. Hand receipts also are not being 
used to control this equipment. 


17. Responsible officials have deferred updating these 
formal and informal records due to other priorities and 
resource constraints. They indicate that they plan to perform 
the updates in the new automated property system recently 
implemented to satisfy these and other recordkeeping require- 
ments. The ODP Resource Acquisitions Management Staff (RAMS) 
should be in a position to assist the Logistics Branch in 
strengthening control over its lease/purchase property. RAMS 
maintains an automated data base which includes information on 


Approved For Release 2005/07/28 : CIA-RDP90-00992R000100040001-6 


Approved For Release pee eee eee 


the status of lease/purchase property. The Logistics Branch 
could use such information to update and reconcile its required 
records and improve property administration. 


Recommendation #6: Conduct an inventory 
of Wang equipment and update the account- 


able property records accordingly. 


Recommendation #7: Update and maintain 
the formal and informal records of lease/ 
purchase equipment. 


Recommendation #8: Establish Consoli- 
dated Memorandum Receipt accounts for 


in-use property. 


Recommendation #9: Reconcile lease/ 


purchase information in the Logistics 
Branch to data in the Resource Acquisi- 
tion Management Staff. 


Recommendation #10: Appoint a Wang systems 
manager, 


” 


Approved For Release 2005/07/28 : CIA-RDP90-00992R000100040001-6 


6 
ec Ff f p Cm 


25X1 Approved For Release 2005/07/28 : CIA-RDP90-00992R000100040001-6 


Approved For Release 2005/07/28 : CIA-RDP90-00992R000100040001-6 


Approved For'Reélease 2005/07/28 : CIA-RDP90-00992R600100040001-6 


ROUTING AND RECORD SHEET 


SUBJECT: (Optional) 


Report of Audit of Office of Data Processing 
_ For the Period 1 May 1982 - 31 May 1984 | opP-¥4=/66 1 
FROM: _ EXTENSION | NO. —. . 


Audit Staff 


1201 Key : STAT 
TO: (Officer designation, room number, and DATE 
building} 2 OFFICER'S COMMENTS (Number each comment to show from whom 
; | INITIALS to whom. Draw a line across column after each comment.) 
RECEIVED FORWARDED 
1, 7 : 
IG 6£18 WQS. 
a. eer + 10] ab. 
~ 29 OCT 1984) 
Director, Data 
Processing 2 D0105 
ee. z = be oe 
“hoa | 
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